How to avoid automatic sign in after SMS verify?

[maganap]

Hello!

I'm using cfaSignIn(‘phone’, {phone: phoneNumber}). I need to disable the automatic sign in feature that's available on Android after the SMS-auto-retrieval.

I noticed internally it uses: PhoneAuthProvider.getInstance().verifyPhoneNumber() So, reading Firebase docs: https://firebase.google.com/docs/reference/android/com/google/firebase/auth/PhoneAuthProvider I found that the timeout parameter can be set to 0 to disable SMS-auto-retrieval. That works perfectly for what I need (disable the auto sign in).

Is there a proper way to make a call to cfaSignIn() avoiding automatic sign in? Or maybe a different approach? First the user signs in with Google or Facebook. Then, I'm verifying the phone number (I'm linking both accounts).

Thank you very much in advance.

[baumblatt]

Hello @maganap ,

Now days there is no option on the plugin to do this, but we can do it together.

We can do it in one of two options below:

• You can code and submit a PR
• I can do it for you

About the behavior, do you need this per authentication event (parameter), or the same for all authentications event (configuration)?

Best regards, Bernardo Baumblatt.

[maganap]

Hi @baumblatt ! Thanks for your reply.

Sure! I can try and make a PR for it. But what I did is not actually solving my problem yet as I thought.

Scenario: We need to allow the user to sign in with Google first, and then verify their phone number. We need to link both accounts. This means the user is already signed in to Google when the phone number is verified.

If we disable SMS auto-retrieval, we can wait for the user to manually input the SMS verification code and then we call: credential = firebase.auth.PhoneAuthProvider.credential(this.verificationId, verificationCode); and then we can link both accounts: user.linkWithCredential(credential);

That works fine, but we lost the SMS auto-retrieval feature.

Problem: We'd like to keep keep the SMS auto-retrieval feature. We only need to avoid auto sign in to be able to link both accounts following the previous procedure. Or maybe we could use a different approach we haven't thought of.

If we keep the SMS auto-retrieval, it automatically signs in with the phone number (so the previous Google account is not logged in anymore, and we can't link both accounts as we need). We tried to retrieve Google credentials before phone number sign in, so we could call user.linkWithCredential(googleCredential); after it automatically signs in with phone number, but we couldn't find a way to make it work without it prompting for Google sign in again.

Any other ideas? Thank you again in advance.

[maganap]

@baumblatt I forgot about your question:

About the behavior, do you need this per authentication event (parameter), or the same for all authentications event (configuration)?

I'm afraid I'm not sure I understand what you're asking. If you mean that I some times need one behaviour and other times a different one, the answer is "no". I always need all users first sign in with Google, and then they need to verify their phone number. When they do, I need to link both of their accounts (Google and phone number).

[nelson6e65]

I'm having this issue too. There is a way to achieve this, even disabling SMS auto detection?

[nelson6e65]

Or there is a way to detect the verification was successful and then, if logged in, performs other actions?

[nelson6e65]

@baumblatt I forgot about your question:

About the behavior, do you need this per authentication event (parameter), or the same for all authentications event (configuration)?

I'm afraid I'm not sure I understand what you're asking. If you mean that I some times need one behaviour and other times a different one, the answer is "no". I always need all users first sign in with Google, and then they need to verify their phone number. When they do, I need to link both of their accounts (Google and phone number).

In my case, I perform a phone validation and then the user can register with email + password.

[dodomui]

Hello!

I'm using cfaSignIn(‘phone’, {phone: phoneNumber}). I need to disable the automatic sign in feature that's available on Android after the SMS-auto-retrieval.

I noticed internally it uses: PhoneAuthProvider.getInstance().verifyPhoneNumber() So, reading Firebase docs: https://firebase.google.com/docs/reference/android/com/google/firebase/auth/PhoneAuthProvider I found that the timeout parameter can be set to 0 to disable SMS-auto-retrieval. That works perfectly for what I need (disable the auto sign in).

Is there a proper way to make a call to cfaSignIn() avoiding automatic sign in? Or maybe a different approach? First the user signs in with Google or Facebook. Then, I'm verifying the phone number (I'm linking both accounts).

Thank you very much in advance.

Hi @maganap, do you mind share how to set timeout to 0 to disable SMS auto retrieval? I need this features also.

[dodomui]

Forgot to update here. I found where to edit the timeout parameter. VS studio seem unable to search through node_modules folder.

It's at main/java/handlers/PhoneProviderHandler.java .verifyPhoneNumber function

[kazlauskis]

I agree that some flag to skip the auto sign-in to the web layer would be useful. At the moment, we are skipping the JS facade and instead prefilling the SMS code in the UI - unified experience across all platforms.

import { Plugins } from '@capacitor/core';
const {CapacitorFirebaseAuth} = Plugins;

const providerId = firebase.auth.PhoneAuthProvider.PROVIDER_ID;
CapacitorFirebaseAuth.signIn({
  providerId,
  data: { phone },
});

cfaSignInPhoneOnCodeSent().subscribe(verificationId => { /** Store the ID */})
cfaSignInPhoneOnCodeReceived().subscribe(({verificationCode}) => { /** Prefill the code in the UI */})

// on verify
const credential = firebase.auth.PhoneAuthProvider.credential(verificationId, verificationCode);
firebase.auth().signInWithCredential(credential);